Tamper-resistant sensor for autonomous vehicles

ABSTRACT

In one example, a method for resolving sensor conflicts in autonomous vehicles includes monitoring conditions around the autonomous vehicle by analyzing data received from a plurality of sensors, detecting a conflict in the data received from two sensors of the plurality of sensors, sending a first instruction to an auxiliary sensor of the autonomous vehicle that is not one of the plurality of sensors, wherein the first instruction instructs the auxiliary sensor to gather additional data about the conditions around the autonomous vehicle, receiving the additional data from the auxiliary sensor, and making a decision regarding operation of the autonomous vehicle, wherein the decision is based at least in part on the additional data.

This application is a continuation of U.S. patent application Ser. No.16/452,780, filed Jun. 26, 2019, now U.S. Pat. No. 11,453,408, which isherein incorporated by reference in its entirety.

The present disclosure relates generally to autonomous vehicles, andrelates more particularly to tamper-resistant sensors for resolvingsensor conflicts in autonomous vehicles.

BACKGROUND

Autonomous vehicles (also referred to as self-driving or driverlessvehicles) are vehicles that are capable of operating with little to nohuman control. Some autonomous vehicles utilize a plurality of differenttypes of sensors (e.g., radio detection and ranging (radar), lightdetection and ranging (LIDAR), sonar, global positioning system (GPS),odometry and inertial measurement units, and the like) and data feeds(e.g., traffic reports, weather reports, and the like) to gather inputsfrom the surrounding environment. These inputs may include, for example,the information displayed on road signs, the current weather or roadconditions, the presence of obstacles, and the like. A control systemmay then analyze these inputs in order to make decisions regarding theoperation of the vehicle (e.g., direction of travel, speed of travel,use of vehicle systems such as headlights and windshield wipers, etc.).Thus, autonomous vehicles are seen as a way of minimizing the effects ofhuman error in vehicle operation.

SUMMARY

The present disclosure describes a tamper-resistant sensor for use inresolving sensor conflicts in autonomous vehicles. In one example, amethod for resolving sensor conflicts in autonomous vehicles includesmonitoring conditions around the autonomous vehicle by analyzing datareceived from a plurality of sensors, detecting a conflict in the datareceived from two sensors of the plurality of sensors, sending a firstinstruction to an auxiliary sensor of the autonomous vehicle that is notone of the plurality of sensors, wherein the first instruction instructsthe auxiliary sensor to gather additional data about the conditionsaround the autonomous vehicle, receiving the additional data from theauxiliary sensor, and making a decision regarding operation of theautonomous vehicle, wherein the decision is based at least in part onthe additional data.

In another example, a non-transitory computer-readable storage mediumstores instructions which, when executed by a processing system of anautonomous vehicle, cause the processing system to perform operations.The operations include monitoring conditions around the autonomousvehicle by analyzing data received from a plurality of sensors,detecting a conflict in the data received from two sensors of theplurality of sensors, sending a first instruction to an auxiliary sensorof the autonomous vehicle that is not one of the plurality of sensors,wherein the first instruction instructs the auxiliary sensor to gatheradditional data about the conditions around the autonomous vehicle,receiving the additional data from the auxiliary sensor, and making adecision regarding operation of the autonomous vehicle, wherein thedecision is based at least in part on the additional data.

In another example, a system includes a plurality of sensors distributedthroughout an autonomous vehicle to continuously gather data aboutconditions around the autonomous vehicle, a processing system to monitorthe conditions based the data gathered by the plurality of sensors, anauxiliary sensor mounted in the autonomous vehicle, wherein theauxiliary sensor operates in an inactive mode as a default, and whereinthe auxiliary sensor does not gather data or transmit data in theinactive mode, and a non-transitory computer-readable storage mediumstoring instructions which, when executed by the processing system,cause the processing system to perform operations. The operationsinclude monitoring conditions around the autonomous vehicle by analyzingdata received from a plurality of sensors, detecting a conflict in thedata received from two sensors of the plurality of sensors, sending afirst instruction to an auxiliary sensor of the autonomous vehicle thatis not one of the plurality of sensors, wherein the first instructioninstructs the auxiliary sensor to gather additional data about theconditions around the autonomous vehicle, receiving the additional datafrom the auxiliary sensor, and making a decision regarding operation ofthe autonomous vehicle, wherein the decision is based at least in parton the additional data.

BRIEF DESCRIPTION OF THE DRAWINGS

The teachings of the present disclosure can be readily understood byconsidering the following detailed description in conjunction with theaccompanying drawings, in which:

FIG. 1 illustrates an example system in which examples of the presentdisclosure for tamper-resistant sensors may operate;

FIGS. 2A-2B are schematic diagrams illustrating one example of atamper-resistant sensor for resolving sensor conflicts in autonomousvehicles;

FIG. 3 illustrates a flowchart of an example method for resolving sensorconflicts in autonomous vehicles, according to examples of the presentdisclosure;

FIG. 4 illustrates a flowchart of an example method for operating atamper-resistant sensor in an autonomous vehicle, according to examplesof the present disclosure; and

FIG. 5 depicts a high-level block diagram of a computing devicespecifically programmed to perform the functions described herein.

To facilitate understanding, identical reference numerals have beenused, where possible, to designate identical elements that are common tothe figures.

DETAILED DESCRIPTION

In one example, the present disclosure provides tamper-resistant sensorsfor resolving sensor conflicts in autonomous vehicles. As discussedabove, autonomous vehicles are seen as a way of minimizing the effectsof human error in vehicle operation. However, the very same featuresthat replace human control (e.g., constant connectivity, software) mayalso make the autonomous vehicles more susceptible to compromise fromoutside parties. For instance, hackers may exploit vulnerabilities inthe software of an autonomous vehicle's control system. This may allowmalicious parties to intercept and/or manipulate communications betweenthe control system and the sensors or other vehicle systems.

As an example, a hacker may manipulate a sensor feed and/or a returnedsignal from a sensor in order to give the control system the falseimpression that there is an obstacle in the vehicle's path. Forinstance, an image feed from a camera may be manipulated to make anonexistent object appear to be moving slowly or to be stopped in thevehicle's path. As a result, the control system may unnecessarily takean action, such as slowing or stopping the vehicle or suddenly swervingfrom the vehicle's path. This action, may, in turn, create a safetyhazard as other vehicles on the road may need to adapt to the action inorder to avoid a collision.

Furthermore, due to the number of internal and external sensor feedsbeing processed by the control system, when any of the feeds from thesensors are being maliciously manipulated, a conflict may arise betweenthe data being received from two or more sensors. For instance, the datafeed generated by a radar sensor may be manipulated to indicate thatthere is an obstacle in the vehicle's path. However, the data feedgenerated by a LIDAR sensor, which is not being manipulated, mayindicate that the vehicle's path is clear. This conflict may confuse thevehicle's control system and make it difficult for the control system totake appropriate actions in a timely manner.

Examples of the present disclosure provide an auxiliary sensor in anautonomous vehicle, where the auxiliary sensor is deployed for resolvingconflicts in the signals from other sensors. In one example, theauxiliary sensor is a camera comprising a minimal amount of electronicsand internal components, thereby making the auxiliary sensor moreresistant to outside manipulation. Moreover, the auxiliary sensor may beactivated only when a conflict is detected in the signals from the othersensors, which reduces the window of time during which the auxiliarysensor may be exposed to attack. At all other times, the auxiliarysensor may remain in an idle or powered down mode. In further examples,the auxiliary sensor may be protected within a housing that is formedfrom a material that is resistant to wireless electronic signals (e.g.,passing carrier waves, signals, lasers, and the like).

Although examples of the present disclosure are described within thecontext of autonomous vehicles, it will be appreciated that the examplesdescribed herein could also be used in conjunction with vehicles thatare not fully autonomous. For instance, the Society of AutomotiveEngineers (SAE) defines a wide range of vehicles that operate withvarying degrees of automation, from SAE Level 0 (i.e., fully manuallyoperated) to SAE Level 5 (fully autonomous). The levels in between SAELevels 0 and Level 5 include various types of semi-autonomous vehicles(e.g., vehicles that are neither fully manually operated nor fullyautonomous). These levels between include vehicles that operate with“driver assistance” (e.g., automated systems used for either steering oracceleration/deceleration), “partial automation” (e.g., automatedsystems used for both steering and acceleration/deceleration),“conditional automation” (e.g., automated systems that rely on aresponse of a human driver to requests for intervention in dynamicdriving tasks), and “high automation” (e.g., automated systems that takeaction in dynamic driving tasks even when the human driver does notrespond to requests for intervention). Examples of the presentdisclosure may be used in conjunction with any of these levels (e.g.,SAE Levels 0-5) of automation, as well as levels of automation that mayhave yet to be explicitly defined.

To further aid in understanding the present disclosure, FIG. 1illustrates an example system 100 in which examples of the presentdisclosure for tamper-resistant sensors may operate. The system 100 mayinclude any one or more types of communication networks, such as atraditional circuit switched network (e.g., a public switched telephonenetwork (PSTN)) or a packet network such as an Internet Protocol (IP)network (e.g., an IP Multimedia Subsystem (IMS) network), anasynchronous transfer mode (ATM) network, a wireless network, a cellularnetwork (e.g., 2G, 3G, and the like), a long term evolution (LTE)network, 5G and the like, related to the current disclosure. It shouldbe noted that an IP network is broadly defined as a network that usesInternet Protocol to exchange data packets. Additional example IPnetworks include Voice over IP (VoIP) networks, Service over IP (SoIP)networks, and the like.

As shown in FIG. 1 , the network 100 connects a plurality of mobile andnon-mobile devices, including an autonomous vehicle 160 and a firstplurality of sensors 156 ₁-156 _(n) (hereinafter individually referredto as a “sensor 156” or collectively referred to as “sensors 156”), withone another and with various other devices via a core network 110, awireless access network 150 (e.g., a cellular network), an accessnetwork 120, other networks 140, and/or the Internet in general. Forinstance, connections between core network 110, access network 120,autonomous vehicle 160, wireless access network 150 and other networks140 may comprise the Internet in general, internal links under thecontrol of single telecommunication service provider network, linksbetween peer networks, and so forth.

In one example, wireless access network 150 may comprise a radio accessnetwork implementing such technologies as: Global System for MobileCommunication (GSM), e.g., a Base Station Subsystem (BSS), or IS-95, aUniversal Mobile Telecommunications System (UMTS) network employingWideband Code Division Multiple Access (WCDMA), or a CDMA3000 network,among others. In other words, wireless access network 150 may comprisean access network in accordance with any “second generation” (2G),“third generation” (3G), “fourth generation” (4G), Long Term Evolution(LTE), “fifth generation” (5G) or any other yet to be developed futurewireless/cellular network technology. While the present disclosure isnot limited to any particular type of wireless access network, in theillustrative example, wireless access network 150 is shown as a UMTSterrestrial radio access network (UTRAN) subsystem. Thus, elements 152and 154 may each comprise a Node B or evolved Node B (eNodeB). In oneexample, wireless access network 150 may be controlled and/or operatedby a same entity as core network 110.

In one example, core network 110 may combine core network components ofa cellular network with components of a triple play service network;where triple play services include telephone services, Internet servicesand television services to subscribers. For example, core network 110may functionally comprise a fixed mobile convergence (FMC) network,e.g., an IP Multimedia Subsystem (IMS) network. In addition, corenetwork 110 may functionally comprise a telephony network, e.g., anInternet Protocol/Multi-Protocol Label Switching (IP/MPLS) backbonenetwork utilizing Session Initiation Protocol (SIP) for circuit-switchedand Voice over Internet Protocol (VoIP) telephony services. Core network110 may also further comprise a broadcast television network, e.g., atraditional cable provider network or an Internet Protocol Television(IPTV) network, as well as an Internet Service Provider (ISP) network.The network elements 111 ₁-111 _(m) (hereinafter individually referredto as a “network element 111” or collectively as “network elements 111”)may serve as gateway servers or edge routers to interconnect the corenetwork 110 with other networks 140, wireless access network 150, accessnetwork 120, and so forth. As shown in FIG. 1 , core network 110 mayalso include a plurality of application servers 114 and a database 112.For ease of illustration, various additional elements of core network110 are omitted from FIG. 1 .

In one example, the access network 120 may comprise a Digital SubscriberLine (DSL) network, a broadband cable access network, a Local AreaNetwork (LAN), a cellular or wireless access network, a 3^(rd) partynetwork, and the like. For example, the operator of core network 110 mayprovide a cable television service, an IPTV service, or any other typesof television service to subscribers via access network 120. In thisregard, access network 120 may include a node 122, e.g., a mini-fibernode (MFN), a video-ready access device (VRAD) or the like. However, inanother example, node 122 may be omitted, e.g., forfiber-to-the-premises (FTTP) installations. Access network 120 may alsotransmit and receive communications between the autonomous vehicle 160and core network 110 relating to data collected by sensors 156,communications with web servers via other networks 140, and/or theInternet in general, and so forth. In another example, access network120 may be operated by a different entity from core network 110, e.g.,an Internet service provider (ISP) network.

Alternatively, or in addition, the network 100 may provide data servicesto the autonomous vehicle 160 via satellite broadcast. For instance,ground station 130 may receive data from the application server(s) 114,database 112, wireless access network 150, other networks 140, and/orthe Internet in general for uplink transmission to the satellite 132.Accordingly, the satellite 132 may receive data from the ground station130 and may broadcast the data to a satellite receiver 134, e.g., asatellite link terrestrial antenna (including satellite dishes andantennas for downlink communications, or for both downlink and uplinkcommunications), as well as to satellite receivers of other subscriberswithin a coverage area of satellite the satellite 132. In one example,satellite 132 may be controlled and/or operated by a same networkservice provider as the core network 110. In another example, satellite132 may be controlled and/or operated by a different entity and maycarry data signals on behalf of the core network 110.

As illustrated in FIG. 1 , core network 110 may include variousapplication servers 114. For instance, application servers 114 may beimplemented to provide certain functions or features, e.g., aServing-Call Session Control Function (S-CSCF), a Proxy-Call SessionControl Function (P-CSCF), or an Interrogating-Call Session ControlFunction (I-CSCF), one or more billing servers for billing one or moreservices, including cellular data and telephony services, wire-linephone services, Internet access services, and television services.Application servers 114 may also include a Home Subscriber Server/HomeLocation Register (HSS/HLR) for tracking cellular subscriber devicelocation and other functions. An HSS refers to a network elementresiding in the control plane of an IMS network that acts as a centralrepository of all customer specific authorizations, service profiles,preferences, etc. Application servers 114 may also include an IMS mediaserver (MS) for handling and terminating media streams to provideservices such as announcements, bridges, and Interactive Voice Response(IVR) messages for VoIP and cellular service applications. The MS mayalso interact with customers for media session management. In addition,application server(s) 114 may also include a presence server, e.g., fordetecting a presence of a user. For example, the presence server maydetermine the physical location of a user or whether the user is“present” for the purpose of a subscribed service, e.g., online for achatting service and the like. In one example, application server(s) 114may perform processing on data feeds received from the sensors 156,e.g., to extract information from the data feeds, where the informationmay subsequently be forwarded to downstream devices. For instance, theapplication server(s) 114 may detect current weather conditions in ageographic location of a sensor 156 based on the information (e.g.,images, humidity levels, temperature readings, etc.) in the sensor'sdata feed. The application server(s) 114 may also perform pre-processingon the raw data feeds (e.g., reduction of noise, motion blur, or thelike) so that the raw data feeds may be more easily interpreted bydownstream devices. In one example, the sensors 56 are continuously indata gathering mode (e.g., always gathering and transmitting data),unless the sensors 164 are damaged or malfunctioning.

The database 112 may store information extracted from data feeds. In oneexample, the information extracted from the data feeds may be storedtemporarily (e.g., discarded once the data feed reaches a threshold age)in order to avoid dedicating storage space to data that may no longer betimely. In another example, the database 112 may store models that helpthe application server(s) 114 to interpret the information contained inthe data feeds. It should be noted that the foregoing are only severalexamples of the types of relevant application server(s) 114 anddatabases 112 that may be included in core network 110 for storinginformation relevant to providing various services to subscribers.

In accordance with the present disclosure, other networks 140 andservers 168 may comprise networks and devices of various contentproviders who may also maintain sensors that provide data about road,weather, and other conditions which may be relevant to the operation ofthe autonomous vehicle.

In one example, the sensors 156 may comprise various types of sensors(e.g., still and/or video cameras, humidity sensors, thermometers,barometers, and the like) that may be distributed along or near aroadway in order to monitor conditions in the vicinity of the roadway(e.g., traffic flows, weather, obstructions, etc.). The sensors 156 mayprovide data (e.g., in the form of continuous feeds and/or discrete datapoints) to the application server(s) 114 in the core network 110. Thesensors 156 may also provide the data directly to the autonomous vehicle160.

In one example, the autonomous vehicle 116 may comprise a motor vehicle(e.g., a passenger vehicle, a tractor trailer, a bus, or the like) thatis equipped with a system that provides some level of autonomousoperation. This system may include, for example, a control system 162and a second plurality of sensors 164 ₁-164 _(p) (hereinafterindividually referred to as a “sensor 164” or collectively referred toas “sensors 164”). The sensors 164 may be distributed throughout theautonomous vehicle 160 (e.g., inside the autonomous vehicle 160 and/oroutside the autonomous vehicle 160) and may include different types ofsensors including radar sensors, LIDAR sensors, sonar sensors, GPSsensors, odometry and inertial measurement units, still and/or videocameras, humidity sensors, thermometers, barometers, and/or the like.The sensors 164 gather inputs from the environment surrounding theautonomous vehicle 160. These inputs may include, for example, theinformation displayed on road signs, the current weather or roadconditions, the presence of obstacles, and the like. In one example, thesensors 164 are continuously in data gathering mode (e.g., alwaysgathering and transmitting data to the control system 162), unless thesensors 164 are damaged or malfunctioning.

The control system 162 may comprise all or a portion of a computingdevice or system, such as computing system 500, and/or processing system502 as described in connection with FIG. 5 below, specificallyconfigured to perform various steps, functions, and/or operations forresolving conflicts in sensor data. For instance, the control system,162 may be configured to analyze the inputs from the sensors 164 and/orthe sensors 156. Based on analysis of the sensor inputs, the controlsystem 162 may make decisions regarding the operation of the vehicle(e.g., direction of travel, speed of travel, use of vehicle systems suchas headlights and windshield wipers, etc.) and may send signals to othervehicle systems 166 in the autonomous vehicle 160 to carry out thedecisions. For instance, the control system 162 may determine, based onanalysis of road images, that an obstacle is present in the road aheadof the autonomous vehicle 160. In response, the control system 162 maysend a signal to the autonomous vehicle's braking system to apply thebrakes (e.g., to slow down the speed of the autonomous vehicle 160).Alternatively the control system 162 may send a signal to the autonomousvehicle's steering system to steer to the left or the right by somespecified amount (e.g., to steer the autonomous vehicle 160 around theobstacle).

The sensors 164 that are deployed within the autonomous vehicle 160 maybe in direct communication with the control system 162 (e.g., via wiredand/or wireless links). The sensors 164 may also communicate with theapplication server(s) 114 in the core network 110 and/or servers 168 inother networks 140 via the access network 120 and/or via satellitereceiver 134. The data from the sensors 156 that are not in directcommunication with the control system 162 may be received by the controlsystem 162 via the access network 120 and/or via satellite receiver 134.In one example, any one or more of the sensors 156 and/or 164 may haveboth cellular and non-cellular access capabilities and may further havewired communication and networking capabilities.

In one example, the second plurality of sensors 164 includes at leastone auxiliary sensor 164 _(p) that is designed to be tamper-resistant.In one example, the auxiliary sensor 164 _(p) is a still or videocamera. The auxiliary sensor 164 _(p) may be protected within a housing170 that is formed from a material that is resistant to wirelesselectronic signals (e.g., passing carrier waves, signals, lasers, andthe like). For instance, the housing may be formed from a material thatcan block WiFi or cellular signals, such as ceramic, metal, mirrors, orthe like. As such, the auxiliary sensor 164 _(p) may be communicativelycoupled to the control system 162 via a wired connection. In oneexample, the housing 170 is movable within a compartment 172 in theautonomous vehicle 160. In one example, the compartment 172 is largeenough to completely conceal the housing 170 when the auxiliary sensor164 _(p) is not actively in use. However, the housing 170 may beconfigured to emerge at least partially from the compartment 172.

In one example, the auxiliary sensor 164 _(p) may be powered off or mayoperate in an idle mode as a default, wherein the idle mode does notallow the auxiliary sensor 164 _(p) to send or receive electronicsignals to or from other devices. However, when a conflict is detectedin the data received from two or more other sensors 164, the sensor 164_(p) may be activated (e.g., powered on or set to an active mode) inorder to gather additional data to resolve the conflict. In one example,the housing 170 of the auxiliary sensor 164 _(p) may be concealed withinthe compartment 172 as long as the auxiliary sensor 164 _(p) is poweredoff or idle, but the housing 170 may emerge from the compartment atleast temporarily when the auxiliary sensor 164 _(p) is activated toallow the auxiliary sensor 164 _(p) to gather data.

In addition, it should be noted that as used herein, the terms“configure,” and “reconfigure” may refer to programming or loading aprocessing system with computer-readable/computer-executableinstructions, code, and/or programs, e.g., in a distributed ornon-distributed memory, which when executed by a processor, orprocessors, of the processing system within a same device or withindistributed devices, may cause the processing system to perform variousfunctions. Such terms may also encompass providing variables, datavalues, tables, objects, or other data structures or the like which maycause a processing system executing computer-readable instructions,code, and/or programs to function differently depending upon the valuesof the variables or other data structures that are provided. As referredto herein a “processing system” may comprise a computing deviceincluding one or more processors, or cores (e.g., as illustrated in FIG.5 and discussed below) or multiple computing devices collectivelyconfigured to perform various steps, functions, and/or operations inaccordance with the present disclosure.

In addition, it should be noted that the network 100 may be implementedin a different form than that which is illustrated in FIG. 1 , or may beexpanded by including additional endpoint devices, access networks,network elements, application servers, and the like, without alteringthe scope of the present disclosure. For example, core network 110 isnot limited to an IMS network. Wireless access network 150 is notlimited to a UMTS/UTRAN configuration. Similarly, the present disclosureis not limited to an IP/MPLS network for VoIP telephony services, or anyparticular type of broadcast television network for providing televisionservices, and so forth.

FIGS. 2A-2B are schematic diagrams illustrating one example of atamper-resistant sensor 200 for resolving sensor conflicts in autonomousvehicles. Specifically, FIG. 2A illustrates the sensor 200 is a poweredoff or idle mode, while FIG. 2B illustrates the sensor 200 in an activemode. The sensor 200 may be deployed in an autonomous vehicle, such asthe autonomous vehicle 160 of FIG. 1 . Thus, the sensor 200 illustratedin FIG. 2 may be deployed as the auxiliary sensor 164 _(p) illustratedin FIG. 1 .

As discussed above, the sensor 200 may comprise a still or video camera.Thus, the sensor 200 may capture still images of sequences of images ofa field of view. For instance, the sensor may comprise an infrared (IR)or near-infrared (NIR) camera, a red, blue, green (RGB) camera, anRGB-IR camera, a full-spectrum camera, or the like. In one example, thesensor 200 has a 360 degree field of view. For instance, if the sensor200 is a camera, the camera may include an arrangement of lenses thatprovides a 360 degree field of view (e.g., back-to-back fisheye lenses).In another example, the sensor 200 may be coupled to a rotor or motorthat adjusts the position of the lens in order to capture an image of adesired field of view.

As also discussed above, the sensor 200 may be protected within ahousing 204 that is formed from a material that is resistant to wirelesselectronic signals (e.g., passing carrier waves, signals, lasers, andthe like). For instance, the housing may be formed from a material thatcan block WiFi or cellular signals, such as ceramic, metal, mirrors, orthe like. In one example, the housing 204 has a cylindrical shape.

In one example, the housing 204 may be connected to a first actuator210. The first actuator 210 may be configured to drive the housing 204(and, consequently, the sensor 200) linearly along an axis A-A′ (asillustrated by the arrow 220), as well as to rotate the housing 204around the axis A-A′ (as illustrated by the arrow 222). In one example,the first actuator 210 may comprise any type of actuator, such as amechanical actuator, a pneumatic actuator, a hydraulic actuator, anelectric actuator, a thermal or magnetic actuator, or any combinationthereof. For instance, the first actuator 210 may comprise a motor thatdrives a pneumatic cylinder, where the pneumatic cylinder is collinearwith the axis A-A′, and the housing 204 is mounted to the pneumaticcylinder.

As illustrated in FIG. 2A, the housing 204 and/or the first actuator 210may be concealed within a compartment 206 formed within the body of theautonomous vehicle. The compartment 206 may comprise a hollow space inthe vehicle body and may be similar in shape to the housing 204. Forinstance, the compartment 206 may be cylindrical in shape and have aslightly larger diameter than a diameter of the housing 204. However,the compartment 206 may be large enough to house the first actuator 210in addition to the housing 204.

The compartment 206 may be open on one end that is flush orsubstantially flush with the exterior surface 208 of the autonomousvehicle. The compartment 206 may include a door 212 that is movable toopen and close the end of the compartment 206. For instance, the door212 may be connected to a second actuator 214. The second actuator 214may be configured to drive the door 212 linearly along an axis B-B′ thatis substantially perpendicular to the axis A-A′. In one example, thesecond actuator 214 may comprise any type of actuator, such as amechanical actuator, a pneumatic actuator, a hydraulic actuator, anelectric actuator, a thermal or magnetic actuator, or any combinationthereof. For instance, the second actuator 214 may comprise a motor thatdrives a pneumatic cylinder, where the pneumatic cylinder is collinearwith the axis B-B′, and the door 212 is mounted to the pneumaticcylinder. Thus, the door 212, may slide linearly to open and close theopen end of the compartment 206. However, in other examples, the door212 may be operable to open and close the open end of the compartment206 in other ways. For instance, the door 212 may open and close on ahinge, or the door 212 may comprise two halves that slide linearlytoward each other to close the open end and away from each other to openthe open end.

The sensor 200, the first actuator 210, and the second actuator 214 maybe communicatively coupled (e.g., by a wired communication link) to acontrol system 218. The control system 218 may comprise the centralcontrol system for the autonomous vehicle's various sensors (e.g., suchas control system 162 of FIG. 1 ), or the control system 218 maycomprise a control system for the sensor 200 only (in which case, thecontrol system 218 may receive instructions from the central controlsystem). Thus, the control system 218 may send electronic signals to thesensor 200, the first actuator 210, and the second actuator 214, wherethe electronic signals encode instructions for the sensor 200, the firstactuator 210, and the second actuator 214.

As illustrated in FIG. 2A, the housing 204 and sensor 200 may, bydefault, be concealed within the compartment 206. For example, thehousing 204 may be fully retracted into the compartment 206, and thedoor 212 may close the open end of the compartment 206. While concealedwithin the compartment 206, the sensor 200 may be powered off or mayoperate in an idle mode.

However, as illustrated in FIG. 2B, the housing 204 and sensor 200 mayemerge from the compartment 206 when a conflict is detected between thedata received from two or more of the autonomous vehicle's othersensors. In this case, the control system 218 may instruct the firstactuator 210 to drive the housing 204 out of the compartment 206 (e.g.,upward along the axis A-A′). The instruction to the first actuator 210may include a precise identification of a location to which the firstactuator 210 is to direct the sensor 200 (e.g., a direction anddistance, or point along the 360 degree range of rotational motion ofthe housing 204). The control system 218 may also instruct the secondactuator 214 to open the door 212, so that the housing 204 may emergepast the exterior surface 208 of the autonomous vehicle. The controlsystem 218 may also instruct the sensor 200 to acquire data about theenvironment surrounding the autonomous vehicle. For instance, theinstruction to the sensor 200 may cause the sensor 200 to enter anactive mode in which the sensor 200 acquires one or more images of thesurrounding environment. The sensor 200 may send these images to thecontrol system 218 and/or to a central control system for the autonomousvehicle (if the control system 218 is not the central control system).

The configuration of the sensor 200 is not limited by what isillustrated in FIGS. 2A-2B. For instance, in other examples, the housing204 may include a shutter or window over the sensor 200 that opens andcloses. The shutter may remain closed as a default, and open only whenthe sensor 200 enters an active (e.g., data gathering) mode. Theactuators 210 and 214 used to drive the housing 204 and the door 212 mayalso have configurations that differ from what is shown in FIGS. 2A-2B.In addition, it will be appreciated that the autonomous vehicle mayinclude more than one sensor 200.

FIG. 3 illustrates a flowchart of an example method 300 for resolvingsensor conflicts in autonomous vehicles, according to examples of thepresent disclosure. In one example, the steps, functions, or operationsof the method 300 may be performed by a control system of an autonomousvehicle, where the control system receives information about theenvironment surrounding the autonomous vehicle from a plurality ofsensors (and where the plurality of sensors may include sensors that arepart of the autonomous vehicle as well as sensors that are external tothe autonomous vehicle, such as sensors deployed along a roadway). Thus,in one example, the steps, functions, or operations of the method 300may be performed, for example, by the control system 162 illustrated inFIG. 1 or the control system 218 illustrated in FIGS. 2A-2B.

In another example, the steps, functions, or operations of method 300may be performed by a computing device or system 500, and/or processor502 as described in connection with FIG. 5 below. Similarly, in oneexample, the steps, functions, and/or operations of the method 300 maybe performed by a processing system comprising one or more computingdevices collectively configured to perform various steps, functions,and/or operations of the method 300. For instance, multiple instances ofthe computing device or processing system 500 may collectively functionas a processing system. For illustrative purposes, the method 300 isdescribed in greater detail below in connection with an exampleperformed by a processing system.

The method 300 begins in step 302. In step 304, the processing systemmay monitor the conditions in and around an autonomous vehicle byanalyzing data from a plurality of sensors. Some of the sensors may bedeployed within the autonomous vehicle, while some of the sensors may bedeployed externally to the autonomous vehicle, such as along or near aroadway on which the autonomous vehicle is traveling. The sensors mayinclude, for example, radar sensors, LIDAR sensors, sonar sensors, GPSsensors, odometry and inertial measurement units, still and/or videocameras, humidity sensors, thermometers, barometers, and/or the like.

In step 306, the processing system may detect a conflict in the datareceived from two (or more) of the sensors. In one example, a conflictis detected when the data observed and reported by two sensors cannotsimultaneously be true. For instance, images captured by a cameramounted on or near the hood of the autonomous vehicle may show that theroadway ahead of the autonomous vehicle is clear for at least onehundred feet. However, data captured by a radar sensor may indicate thatthere is an obstruction in the roadway approximately twenty feet infront of the autonomous vehicle. A conflict in the data may be a signthat one or more of the sensors has been compromised. For instance, ahacker may have gained access to the radar sensor and manipulated thedata stream that is output by the radar sensor to make it appear as ifthe obstruction is in the roadway, when in reality there is noobstruction.

In step 308, the processing system may send an instruction to atamper-resistant sensor to acquire additional data about the autonomousvehicle and/or the autonomous vehicle's surrounding environment. In oneexample, the tamper-resistant sensor remains in a powered off or idlemode by default, and is activated (e.g., enters an active or datagathering mode) only when the tamper-resistant sensor receives aninstruction from the processing system. Thus, the tamper-resistant isnot one of the sensors from which the processing system received data instep 304. Step 308 may include the processing system sending aninstruction to the tamper-resistant sensor to enter an active mode. In afurther example, a position of the tamper-resistant sensor may beadjustable to gather data from a desired location or direction. In thisexample, step 308 may also include the processing system sending aninstruction to an actuator or other mechanism that specifies a desiredposition of the tamper-resistant sensor (e.g., “point the lens of thetamper-resistant sensor x degrees northwest”).

In a further example, the tamper-resistant sensor may be wholly orpartially concealed within the autonomous vehicle. For instance, ahousing that protects the tamper-resistant sensor may be concealedwithin a compartment that opens upon a command from the processingsystem. Alternatively or in addition, a shutter may cover at least aportion of the tamper-resistant sensor when the tamper-resistant sensoris not gathering data. Thus, step 308 may include the processing systemsending an instruction to one or more actuators or other mechanisms touncover all or part of the tamper-resistant sensor.

In step 310, the processing system may receive data from thetamper-resistant sensor in response to the instruction sent in step 308.For instance, if the tamper-resistant sensor is a camera, the processingsystem may receive a still image or a sequence of images (e.g., a video)of a field of view that was requested in the instruction (e.g., imagesof a location that is x degrees northwest of the autonomous vehicle, iffollowing the above example).

In step 312, the processing system may make a decision regardingoperation of the autonomous vehicle, based at least in part on the datareceived from the tamper-resistant sensor in step 310. For instance, thedata received from the tamper-resistant sensor may resolve the conflictdetected in step 306. As an example, if the detected conflict related tothe presence of an obstruction in the roadway ahead of the autonomousvehicle, the processing system may determine, based on the data receivedin step 310, that there is no obstruction. In this case, the processingsystem may determine that the autonomous vehicle should continue tooperate in a current state (e.g., at a current speed and/or in a currentdirection of travel, etc.). Alternatively, the processing system maydetermine, based on the data received in step 310, that there is anobstruction. In this case, the processing system may determine that theautonomous vehicle should operate in an altered state (e.g., shouldchange speed and/or direction of travel, etc.) to avoid the obstruction.

In optional step 314 (illustrated in phantom), the processing system maysend an instruction to at least one vehicle system of the autonomousvehicle to alter the operation of the autonomous vehicle. For instance,if it is decided in step 312 that the autonomous vehicle should slowdown or stop to avoid colliding with an obstacle, the processing systemmay send an instruction to the braking system of the autonomous vehiclerequesting that the speed of the autonomous vehicle be reduced.Alternatively, if it is decided in step 312 that the autonomous vehicleshould change its direction of travel to avoid colliding with anobstacle, the processing system may send an instruction to the steeringsystem of the autonomous vehicle requesting that the autonomous vehicleveer to the left or to the right.

Once a decision regarding the operation of the autonomous vehicle ismade in step 312 (and potentially acted upon in step 314), the method300 may return to step 300 and continue to monitor the conditions in andaround an autonomous vehicle, as discussed above, until or unlessanother conflict is detected.

FIG. 4 illustrates a flowchart of an example method 400 for operating atamper-resistant sensor in an autonomous vehicle, according to examplesof the present disclosure. In one example, the steps, functions, oroperations of the method 400 may be performed by a tamper-resistantsensor of an autonomous vehicle, where the tamper-resistant sensorgathers information about the environment surrounding the autonomousvehicle. Thus, in one example, the steps, functions, or operations ofthe method 400 may be performed, for example, by the auxiliary sensor164 _(p) illustrated in FIG. 1 or the sensor 200 illustrated in FIGS.2A-2B.

The method 400 begins in step 402. In step 404, an inactive (e.g.,powered off or operating in idle mode) sensor in an autonomous vehiclemay receive an instruction from a processing system to enter an active(e.g., data gathering) mode. In one example, the processing system is acontrol system of the autonomous vehicle (e.g., a central system thatgathers data from a plurality of sensors and analyzes the data to makedecisions regarding the operation of the autonomous vehicle). In oneexample, the sensor is a still or video camera (e.g., an IR or NIRcamera, an RGB camera, an RGB-IR camera, a full-spectrum camera, or thelike).

In step 406, the sensor may enter the active mode and gather data froman environment surrounding the autonomous vehicle, in response to theinstruction received in step 404. Thus, if the sensor is a camera, thesensor map capture an image or a series of images of the environmentsurrounding the autonomous vehicle. In one example, an actuator or othermechanism may position the sensor so that the gathered data depicts aspecific location (e.g., a specific direction and distance, such as xdegrees northwest of and y feet away from the autonomous vehicle) withinthe environment surrounding the autonomous vehicle.

In step 408, the sensor may transmit the data gathered in step 406 tothe processing system. For instance, the data may be transmitted via awired link between the sensor and the processing system.

In step 410, the sensor may exit the active mode (e.g., may power downor enter an idle mode). In one example, exiting the active mode involvesentering a mode of operation in which the sensor does not transmit orreceive electronic signals. In one example, the sensor exits the activemode automatically after transmitting the data in step 408. In anotherexample, the sensor exits the active mode in response to an instructionfrom the processing system.

The method 400 ends in step 412.

Although not expressly specified above, one or more steps of the methods300 and/or 400 may include a storing, displaying and/or outputting stepas required for a particular application. In other words, any data,records, fields, and/or intermediate results discussed in the method canbe stored, displayed and/or outputted to another device as required fora particular application. Furthermore, operations, steps, or blocks inFIGS. 3 and/or 4 that recite a determining operation or involve adecision do not necessarily require that both branches of thedetermining operation be practiced. In other words, one of the branchesof the determining operation can be deemed as an optional step.Furthermore, operations, steps or blocks of the above describedmethod(s) can be combined, separated, and/or performed in a differentorder from that described above, without departing from the exampleembodiments of the present disclosure.

FIG. 5 depicts a high-level block diagram of a computing devicespecifically programmed to perform the functions described herein. Forexample, any one or more components or devices illustrated in FIG. 1 or2A-2B or described in connection with the methods 300 or 400 may beimplemented as the system 500. For instance, a control system of anautonomous vehicle (as illustrated t 162 in FIG. 1 or at 218 in FIGS.2A-2B) could be implemented as illustrated in FIG. 5 .

As depicted in FIG. 5 , the system 500 comprises a hardware processorelement 502, a memory 504, a module 505 for resolving sensor conflictsin autonomous vehicles, and various input/output (I/O) devices 506.

The hardware processor 502 may comprise, for example, a microprocessor,a central processing unit (CPU), or the like. The memory 504 maycomprise, for example, random access memory (RAM), read only memory(ROM), a disk drive, an optical drive, a magnetic drive, and/or aUniversal Serial Bus (USB) drive. The module 505 for resolving sensorconflicts in autonomous vehicles may include circuitry and/or logic forperforming special purpose functions relating to operating an autonomousvehicle. The input/output devices 506 may include, for example, acamera, a video camera, storage devices (including but not limited to, atape drive, a floppy drive, a hard disk drive or a compact disk drive),a receiver, a transmitter, a speaker, a microphone, a transducer, adisplay, a speech synthesizer, a haptic device, a sensor, an outputport, or a user input device (such as a keyboard, a keypad, a mouse, andthe like).

Although only one processor element is shown, it should be noted thatthe dedicated computer may employ a plurality of processor elements.Furthermore, although only one computer is shown in the Figure, if themethod(s) as discussed above is implemented in a distributed or parallelmanner for a particular illustrative example, i.e., the steps of theabove method(s) or the entire method(s) are implemented across multipleor parallel computers, then the computer of this Figure is intended torepresent each of those multiple computers. Furthermore, one or morehardware processors can be utilized in supporting a virtualized orshared computing environment. The virtualized computing environment maysupport one or more virtual machines representing computers, servers, orother computing devices. In such virtualized virtual machines, hardwarecomponents such as hardware processors and computer-readable storagedevices may be virtualized or logically represented.

It should be noted that the present disclosure can be implemented insoftware and/or in a combination of software and hardware, e.g., usingapplication specific integrated circuits (ASIC), a programmable logicarray (PLA), including a field-programmable gate array (FPGA), or astate machine deployed on a hardware device, a computer or any otherhardware equivalents, e.g., computer readable instructions pertaining tothe method(s) discussed above can be used to configure a hardwareprocessor to perform the steps, functions and/or operations of the abovedisclosed method(s). In one example, instructions and data for thepresent module or process 505 for resolving sensor conflicts inautonomous vehicles (e.g., a software program comprisingcomputer-executable instructions) can be loaded into memory 504 andexecuted by hardware processor element 502 to implement the steps,functions or operations as discussed above in connection with theexample method 300. Furthermore, when a hardware processor executesinstructions to perform “operations,” this could include the hardwareprocessor performing the operations directly and/or facilitating,directing, or cooperating with another hardware device or component(e.g., a co-processor and the like) to perform the operations.

The processor executing the computer readable or software instructionsrelating to the above described method(s) can be perceived as aprogrammed processor or a specialized processor. As such, the presentmodule 505 for resolving sensor conflicts in autonomous vehicles(including associated data structures) of the present disclosure can bestored on a tangible or physical (broadly non-transitory)computer-readable storage device or medium, e.g., volatile memory,non-volatile memory, ROM memory, RAM memory, magnetic or optical drive,device or diskette and the like. More specifically, thecomputer-readable storage device may comprise any physical devices thatprovide the ability to store information such as data and/orinstructions to be accessed by a processor or a computing device such asa computer or an application server.

While various examples have been described above, it should beunderstood that they have been presented by way of example only, and notlimitation. Thus, the breadth and scope of a disclosed example shouldnot be limited by any of the above-described examples, but should bedefined only in accordance with the following claims and theirequivalents.

What is claimed is:
 1. A method comprising: monitoring, by a processingsystem of an autonomous vehicle, conditions around the autonomousvehicle by analyzing data received from a plurality of sensors;detecting, by the processing system, a conflict in the data receivedfrom two sensors of the plurality of sensors, wherein the conflict isdetected when the data received from the two sensors cannot besimultaneously true; sending, by the processing system in response tothe detecting the conflict in the data, a first instruction to anauxiliary sensor of the autonomous vehicle that is not one of theplurality of sensors, wherein the first instruction instructs theauxiliary sensor to gather additional data about the conditions aroundthe autonomous vehicle; receiving, by the processing system, theadditional data from the auxiliary sensor; making, by the processingsystem, a decision to maintain an operation of the autonomous vehicle ina current state without an alteration, wherein the decision is based atleast in part on the additional data; and controlling, by the processingsystem, a vehicle system of the autonomous vehicle to maintain theoperation of the autonomous vehicle in the current state in accordancewith the decision.
 2. The method of claim 1, wherein the auxiliarysensor comprises a camera.
 3. The method of claim 1, wherein theauxiliary sensor is protected within a housing that is formed from amaterial that is resistant to wireless electronic signals.
 4. The methodof claim 3, wherein the housing is movable into and out of a compartmentformed in a body of the autonomous vehicle.
 5. The method of claim 4,further comprising: sending, by the processing system, a secondinstruction to an actuator of the autonomous vehicle, wherein the secondinstruction instructs the actuator to temporarily move the housing outof the compartment.
 6. The method of claim 5, wherein the secondinstruction additionally instructs the actuator to adjust a directionand a distance from which the auxiliary sensor captures the additionaldata.
 7. The method of claim 1, wherein the auxiliary sensor remains inan inactive mode of operation as a default.
 8. The method of claim 7,wherein the auxiliary sensor is refrained from sending and receivingelectronic signals in the inactive mode.
 9. The method of claim 7,wherein the first instruction includes an instruction for the auxiliarysensor to enter an active mode of operation.
 10. The method of claim 1,wherein the controlling comprises controlling a braking system of theautonomous vehicle to maintain a current speed of the autonomousvehicle.
 11. The method of claim 1, wherein the controlling comprisescontrolling a steering system of the autonomous vehicle to maintain adirection of travel of the autonomous vehicle.
 12. The method of claim1, wherein the plurality of sensors continuously send the data to theprocessing system, but the auxiliary sensor only sends the additionaldata to the processing system when the auxiliary sensor receives thefirst instruction.
 13. The method of claim 1, wherein the additionaldata received from the auxiliary sensor resolves the conflict.
 14. Anon-transitory computer-readable storage medium storing instructionswhich, when executed by a processing system of an autonomous vehicle,cause the processing system to perform operations, the operationscomprising: monitoring conditions around the autonomous vehicle byanalyzing data received from a plurality of sensors; detecting aconflict in the data received from two sensors of the plurality ofsensors, wherein the conflict is detected when the data received fromthe two sensors cannot be simultaneously true; sending, in response tothe detecting the conflict in the data, a first instruction to anauxiliary sensor of the autonomous vehicle that is not one of theplurality of sensors, wherein the first instruction instructs theauxiliary sensor to gather additional data about the conditions aroundthe autonomous vehicle; receiving the additional data from the auxiliarysensor; making a decision to maintain an operation of the autonomousvehicle in a current state without an alteration, wherein the decisionis based at least in part on the additional data; and controlling avehicle system of the autonomous vehicle to maintain the operation ofthe autonomous vehicle in the current state in accordance with thedecision.
 15. The non-transitory computer-readable storage medium ofclaim 14, wherein the vehicle system comprises a braking system or asteering system.
 16. A system comprising: a plurality of sensorsdistributed throughout an autonomous vehicle to continuously gather dataabout conditions around the autonomous vehicle; a processing system tomonitor the conditions based on the data gathered by the plurality ofsensors; an auxiliary sensor mounted in the autonomous vehicle, whereinthe auxiliary sensor operates in an inactive mode as a default, andwherein the auxiliary sensor does not gather data or transmit data inthe inactive mode; and a non-transitory computer-readable medium storinginstructions which, when executed by the processing system, cause theprocessing system to perform operations, the operations comprising:detecting a conflict in the data received from two sensors of theplurality of sensors, wherein the conflict is detected when the datareceived from the two sensors cannot be simultaneously true; sending, inresponse to the detecting the conflict in the data, a first instructionto the auxiliary sensor, wherein the first instruction instructs theauxiliary sensor to enter an active mode in which the auxiliary sensorgathers additional data about the conditions around the autonomousvehicle; receiving the additional data from the auxiliary sensor; makinga decision to maintain an operation of the autonomous vehicle in acurrent state without an alteration, wherein the decision is based atleast in part on the additional data; and controlling a vehicle systemof the autonomous vehicle to maintain the operation of the autonomousvehicle in the current state in accordance with the decision.
 17. Thesystem of claim 16, further comprising: a housing protecting theauxiliary sensor, wherein the housing is formed from a material that isresistant to wireless electronic signals.
 18. The system of claim 17,further comprising: an actuator coupled to the housing to move thehousing into and out of a compartment formed in a body of the autonomousvehicle and to adjust a direction and a distance from which theauxiliary sensor gathers data.
 19. The system of claim 18, wherein thecompartment conceals the auxiliary sensor when the housing is moved intothe compartment.
 20. The system of claim 16, wherein the auxiliarysensor is a camera.